android bloatware in business

android device arrive with alot of preinstalled app like facebook, flipboard, skype and for sure google service (youtube,maps,gmail,etc.) – for private use this is anoying, but for business it is essential to secure the usecase

android enterprise

when enabling Android Enterprise for Kiosk/Company devices, during setup the default apps could be disabled with this switch – PROVISIONING_LEAVE_ALL_SYSTEM_APPS_ENABLED – Samsung offers this with it’s KNOX Mobile Enrollment and google with buildin zero-touch service

be aware that you loose the native camera app if your usecase require one

device management

after your device is enrolled in mobile device managment system (emm, uem or whatever) your able to restrict installed apps by package name, apps differ from device manufaturer and os level, package names also useful to arrange/allow in kiosk setup, for samsung XCover4s these are:

• com.samsung.android.messaging
• com.sec.android.app.samsungapps
• com.samsung.android.calendar
• com.samsung.android.email.provider
• com.sec.android.app.myfiles
• com.sec.android.gallery3d
• com.sec.android.app.clockpackage.clockpackage
• com.sec.android.app.clockpackage.alarm.alarmalert
• com.google.android.gm
• com.google.android.youtube
• com.google.android.googlequicksearchbox
• com.sec.android.app.fm
• com.google.android.apps.maps
• com.samsung.android.contacts
• com.samsung.android.dialer
• com.samsung.android.game.gamehome
• com.sec.factory.camera
• com.sec.android.app.camera
• com.sec.android.app.clockpackage
• com.sec.android.app.sbrowser
• com.microsoft.skydrive
• com.facebook.katana

adb tools

remove bloatware from a single device or find from from a reference device locally connected

1. install USB drivers for your device
2. download & install ADB tools
3. enable Developer Options & USB debugging
4. plug in your device into the computer
5. open a terminal and type: adb devices
6. will return the ID of your device
7. in adb shell with: adb shell
8. list all installed packages: pm list packages
9. to remove packages type: pm uninstall -k -user 0 <package name>

take care to not disable system critical apps of android, check here

iOS13 just released, but already updated

…with some interesting festures:

• share ETA in maps
• dynamic wallpapers
• icon of volume slide

even for enterprise mobility there is some interesing festure, with iOS13.1 it’s possible to silently update an App, it will close, update and continue in kiosk/single app-mode.

more about apple developer beta at beta.apple.com

or read about how to downgrade beta

https://madereal.blog/2019/03/19/downgrade-beta/

windows managed kiosk

kiosk is a configuration for single purpose devices(cosu) e.g. info stand or remote work device – provide conditional access in public and semi public areas – ios could set in supervised mode and enable device owner for android to convert consumer devices to fit business needs

autostart is a convenient but unsecure way accomplish a kiosk like behavior and with app locker it is possible to blacklist apps, but both are not an enterprise solution

assigned access to assign an app to a user – just universal windows platform(uwp) or modern apps are supported – located in settings > familiy and other users > set up assigned access – this could remote configured via syncml or powershell

once you have set everything up, simply relogin to the selected account, the app automatically launch

kiosk apps already existing next to mdm, uses the technoligy – microsoft advices how to build your kiosk app – there a separate layer to develop it and even quit assigned access via software

lockHost->RequestUnlock();

hosted web apps are the easiest way to pin a webpage to a windows client in a kiosk setup – like web clips for ios devices, since ios 11.3 it could arranged with the home screen layout– create a web view with windows template studio

fall update 1709 with it’s windows release it is possible to select allowed apps, provide a startlayout and disable taskbar, even device win32 applications – remote configured via mobile device management

spring update 1803 published days ago, assinged access csp advanced to configure shell launcher – “you cannot configure both assigned access and shell launcher on the same system” – additionally the accounts csp added to create a new local windows account

since microsoft doesn’t provied any smartphone – it is prepared persist in enterprise – outlook to new build 17661, a modern snipping experience